3 ms·
It enables phishing where you're actually logged in after submitting your credentials. You don't need a MITM from a network perspective.
by nijave 5y ago
It enables phishing where you're actually logged in after submitting your credentials. You don't need a MITM from a network perspective.
- hedora 5y agoSeparately, if the attacker has the password and a mitm for the totp code, then this allows them to logg in without being detected.